trails/openspec/changes/link-share-tokens/specs/link-sharing/spec.md at 5dd4968626e98466a447cdcdcb7945aecea646c0

Ullrich Schäfer 5dd4968626 docs+openspec: prior-art research (Organic Maps, Endurain, wanderer) and 15 proposals

Add docs/inspirations.md as the durable record of the 2026-07-05/06
prior-art research — per-project learnings with source paths, canonical
credit lines, and the changes each spawned — and extend the
acknowledgment lists in philosophy.md/architecture.md (Organic Maps,
Endurain, wanderer).

New OpenSpec changes (proposal/design/specs/tasks each):
- Organic Maps: elevation-profile-hardening, gpx-parser-robustness,
  hiking-time-estimate, poi-index, hiking-foot-profile
- Endurain: account-export, activity-duplicate-review,
  fit-parsing-hardening, activity-locations, self-hosting-guide,
  activity-privacy-controls
- wanderer: federation-hardening, link-share-tokens
- credits-page (user-visible acknowledgments)

Updated in-flight changes with wanderer prior-art sections:
route-federation, route-discovery.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-06 07:23:00 +02:00

2.1 KiB

Raw Blame History

ADDED Requirements

Owners SHALL be able to create one or more share links per route or activity. A request carrying a valid (unrevoked, unexpired) link token SHALL receive the resource's read-only non-owner view regardless of private visibility, with all non-owner privacy masking applied. Tokens SHALL have at least 128 bits of entropy and be stored hashed; the plaintext SHALL be shown only at creation.

Scenario: Private route opened via link

WHEN someone without an account opens a private route's share link
THEN they see the route read-only

Scenario: Privacy mask still applies

WHEN an activity with hideMap set is opened via share link
THEN the link viewer sees no geometry or GPX download

Scenario: Invalid token fails closed

WHEN a request presents a revoked, expired, or unknown token
THEN access falls back to the resource's normal visibility rules

Requirement: Link management

The share dialog SHALL list a resource's links with label, created and last-used timestamps, support optional expiry at creation, and allow revoking each link individually. Deleting the resource SHALL delete its links.

Scenario: Revoke one of several links

WHEN an owner revokes one link while another exists
THEN the revoked link stops resolving and the other continues to work

Requirement: Links never widen distribution

Link-shared resources SHALL NOT appear in feeds, listings, search, sitemaps, or federation as a consequence of link creation, and link-accessed pages SHALL be marked non-indexable.

Scenario: Linked private route stays out of listings

WHEN a private route has active share links
THEN it appears in no feed, listing, search result, or ActivityPub object

Requirement: Token lookup rate limiting

Share-link resolution SHALL be rate-limited per IP to blunt token scanning, without affecting normally-visible content.

Scenario: Scanning throttled

WHEN an IP rapidly probes many invalid tokens
THEN further lookups from that IP are rejected with 429 for a cooldown period

2.1 KiB Raw Blame History